WP Manifestindependent plugin directory
manifest / builders / oxygen-admin-plus

Oxygen 2.0 Admin Plus WP RegistryHigh-severity findings · 2 findingsOpen the reportD+

Enhanced Oxygenbuilder Admin

by Didou Schol · github.com/badabingbreda/oxygen-admin-plus · website

★ 2stars
1.0.3latest · 8 years ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/badabingbreda/oxygen-admin-plus/archive/refs/heads/master.zip
Updates itself. It ships its own updater, so new versions appear under Dashboard → Updates.
From the readme github.com/badabingbreda/oxygen-admin-plus ↗
Oxygen 2.0 Admin Plus This plugin enhances the current Oxygenbuilder 2.0 Alpha release with some extra Wordpress Dashboard features. - You can choose to have extra row actions to direct edit the contents with the fantastic Oxygenbuilder 2.0 - Directly open the layout in Oxygen 2.0 and see if a layout is active on this post. - Add a link to directly remove the oxygen-layout to revert output back to the original WP-content. - Add extra columns to the Templates overview so you can see what rules apply to that template. Also see if a re-usable template is in use, so you know if it's safe to remove it. How to install - Download the latest release file from github (https://github.com/badabingbreda/oxygen-admin-plus/releases) - Upload and activate By default it will enable on Posts, Pages and Templates. it will also Include the Remove Oxygen Contents-button and add the columns to the Templates overview. You can change the settings on the Settings Oxygen Admin Plus page. release history 1.0.3 (2018-04-25) - Added ctinner=true to 'Edit with Oxygen' row-button in dash for working header/footer 1.0.2 (2018-04-18) - fixed a bug on admin-page that interfered with other admin-pag

Releases

4 releases.

Tag
Published
1.0.3 latest
Apr 25, 2018 8 years ago
1.0.2
Apr 18, 2018 8 years ago
1.0.1
Apr 18, 2018 8 years ago
1.0
Apr 18, 2018 8 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

D+ grade

Security

Oxygen 2.0 Admin Plus 1.0.3 · audited by WP Registry

High-severity findings.

2 high
Audited release
1.0.3
Findings
2
Worst severity
high
Content hash
fa59574fdb8946adad95f631…

Findings

  • high Missing capability and broken nonce on settings update via admin_action_update

    missing_capability

    cl_update_oplus_options is hooked to admin_action_update. It references undefined $nonce, calls wp_verify_nonce($nonce) without checking the result, and never calls current_user_can. Any logged-in user posting option_page=oplus_settings to admin.php?action=update can rewrite oadminplus_post_types / removeoxsc / add_columns options.

    includes/oxygenbuilder2_plus_admin_options.php:73-110

    Recommendation

    Require manage_options; check_admin_referer with a dedicated action; do not hook the generic admin_action_update.

  • high Reflected XSS via unsanitized $_GET['ct_message'] in admin notice

    xss_reflected

    show_success() echoes $_GET['ct_message'] through _e() without escaping. After the removeoxsc redirect (which sets ct_message from attacker-controlled post id path) or any crafted admin URL, script executes in an authenticated admin context.

    includes/oxygenbuilder2_add_row_buttons.php:98-104

    Recommendation

    Use esc_html() on a fixed allowlist of messages; never echo raw query args.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →